Analysis
-
max time kernel
93s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
main.exe
-
Size
1.1MB
-
MD5
1d363ea7301c6c6feaddfc4a591a27cd
-
SHA1
3677acc29ad990542f05bd86f4b8025c3bc3652d
-
SHA256
211f14448b9c3d094c384ad365a5e0899f91fd015f138e99edf068b1aac8d3ab
-
SHA512
acd1824af37a67a754110704eb761325951dfe2732d8f2b967862a951ea47aee6cc5a78a602d3ec612a918612c67ffa41feca66f0882314d6356fa2d5f52bf68
-
SSDEEP
24576:0jDMacqe/kumuSgsZdRVw8D/Pt9htFEcOuCPtIggndsY0s0:wMce/bcgsVD/PfhfOuQqdF0
Malware Config
Signatures
-
Renames multiple (632) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation F221.tmp -
Deletes itself 1 IoCs
pid Process 4228 F221.tmp -
Executes dropped EXE 1 IoCs
pid Process 4228 F221.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini main.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini main.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PP056mb5sqjpbqo8ub5kivbdp4.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPuzs7rn99wh4d10a4lx7tj4dhd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPjf4698zeakzx73hiesojv7zgd.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 3176 main.exe 3176 main.exe 3176 main.exe 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1540 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe 3176 main.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp 4228 F221.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeDebugPrivilege 3176 main.exe Token: 36 3176 main.exe Token: SeImpersonatePrivilege 3176 main.exe Token: SeIncBasePriorityPrivilege 3176 main.exe Token: SeIncreaseQuotaPrivilege 3176 main.exe Token: 33 3176 main.exe Token: SeManageVolumePrivilege 3176 main.exe Token: SeProfSingleProcessPrivilege 3176 main.exe Token: SeRestorePrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSystemProfilePrivilege 3176 main.exe Token: SeTakeOwnershipPrivilege 3176 main.exe Token: SeShutdownPrivilege 3176 main.exe Token: SeDebugPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeBackupPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe Token: SeSecurityPrivilege 3176 main.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3176 main.exe 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE 624 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3200 3176 main.exe 91 PID 3176 wrote to memory of 3200 3176 main.exe 91 PID 3176 wrote to memory of 4228 3176 main.exe 94 PID 3176 wrote to memory of 4228 3176 main.exe 94 PID 3176 wrote to memory of 4228 3176 main.exe 94 PID 3176 wrote to memory of 4228 3176 main.exe 94 PID 1776 wrote to memory of 624 1776 printfilterpipelinesvc.exe 95 PID 1776 wrote to memory of 624 1776 printfilterpipelinesvc.exe 95 PID 4228 wrote to memory of 692 4228 F221.tmp 101 PID 4228 wrote to memory of 692 4228 F221.tmp 101 PID 4228 wrote to memory of 692 4228 F221.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3200
-
-
C:\ProgramData\F221.tmp"C:\ProgramData\F221.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F221.tmp >> NUL3⤵PID:692
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\S6Lg3N7cq.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4280
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{E071DAB1-9BA7-4601-8434-49A0071D81CD}.xps" 1336510362170300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD59cd4d0628e7c76d05e6a188ad8eda755
SHA1b5dd5ff5127660be42c436c600f892ac7af93e4e
SHA2565ee0863762434d3544be5c8c82928ccec4d87c7e3d74406697bf8933aef3f05d
SHA5127b5fa9980232c3bdc5d076e394afb660105e4e73ee25488672750403e2983857943f70c8e47f284eabe2a8207c2769acd43ace37346e9296a1c0ac8aff2ac641
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
289B
MD5343cf231bf640aee5079dafeac910456
SHA1986593eb26aac8592140bc47a677d3a849fd37c6
SHA256e191e18d1f27b1312b9f9599867b4b2bd99ede3af66b50cf91c45300ca49740c
SHA512308507c924fffa902a70343730c416c2d5e19e2958326a90640893a9559ba1e894d17f2e44dcb0b1d9b3b2dd3e3c0e5b9d13c659b90238fc4d497cccd1ca1185
-
Filesize
1.1MB
MD5bcf96e8d477f1566976db6fa52306ec2
SHA1aa7a6b6cce613d49d3098b93fd712b808924a834
SHA25628a44a26a9db6c67a2f801e535efae6447dbc5bc0a17bb7166e1d4ab650babd3
SHA512a4f0922af5e7d719ae764a6653da9faee72a8d74d64f6609de5db18d5c8054a5ec6e5c2f32a3abf3f4af17d836917901d3e112971c9991535dddc72f5841afc7
-
Filesize
4KB
MD5105c224e376265abedc58a33b3305f2d
SHA13628a4326461696102c23fc4c1574b4c5b28aa85
SHA2565327aac44c954f49e2fb5000e5544814f0fc51dc8ae0ac763828293bc0a2c6d8
SHA512208a71338524010f8733056b916f70d5883f391dd38a87c9c94561ff678efee90ef8434d08bc3a6741f75484a17d17cc29bc3f43eac10a9b43f264cfdc9daea3
-
Filesize
129B
MD5bc3596117bd76f44afb0575bb53cbde8
SHA15add5e157cd66248f17c50faf19bdb3f7ca2e7e9
SHA2567cd46eb7e9b98f3ab04a6c83100ebdd05c49c0097cd26aa2ccde362a9caa3d56
SHA512b06604124f5a4922544bce06c9186192d9f68d6d7b800ff8dd735dddb51728b6bdbc5ef27d2cc5c64a280214823a98ac107525bb62550713f8e140a178aefdc4